Core Contracts

Summary

The RAACReleaseOrchestrator contract's documentation suggests that category allocations are immutable [https://docs.raac.io/core/minters/RAACReleaseOrchestrator?id=notes], while the actual implementation includes a function updateCategoryAllocation that allows the admin to modify these values. Although the function includes basic safety checks, this discrepancy between documentation and implementation could lead to confusion among stakeholders.

Vulnerability Details

The contract implements category allocations with two conflicting approaches:

• Initial Setup in Constructor:

• Mutable Implementation

Impact

• No upper bounds on allocation changes

• Exceed intended total supply percentage (65%)

• Confusion among stakeholders

• Protocol can increase different categories to their benefit which has direct impact on the other beneficiaries stake because it inflates their share

Tools Used

• Manual Review

Recommendations

The contract's functionality is sound, but the documentation should be updated to accurately reflect the mutable nature of category allocations or the update function should be removed from the contract. This will ensure transparency and prevent any misunderstandings among stakeholders.